Round verifier

Verify round 2

Fetch the round and every input below fills from the round record and the Bitcoin chain; every check runs in your browser. Nothing here asks you to trust Luckotto: swap in your own evidence at any point.

Round 2

Waiting for round evidence

Fetch a round to load its record, committed CSV, and chain evidence.

Passing0

Waiting8

Failing0

Evidence

Fetching a round fills every field below, and all of them stay editable. Swap in your own values — paste a CSV you downloaded earlier, or point the settings at your own Esplora node — and the checks recompute instantly. The chip on each field says where its current value came from.

On-chain commitment evidence

Commitment address

bc1pd8jxjgycjf5sv92xffz4v4c93683stee7908chrtfe3que70e83sn8qajrView

Derivation path

First confirmed spend (commitment tx)

Pending

Commitment block height

Pending

OP_RETURN CSV HMAC

Pending

Round secret hash32 bytes of hex. SHA-256 of the round secret, published the moment the round locks; it keys the CSV commitment HMAC.Round secret32 bytes of hex. Generated at commitment time and revealed when the round resolves.Final ticket CSVThe HMAC covers the exact bytes, including the trailing newline. The loaded value uses the exact published bytes.Draw block heightPrefills from the confirmed commitment block plus the draw delay once the chain evidence loads.Draw block hashFetched from Esplora at the draw height. The checkpoint chain starts from this hash.Checkpoints7 per round (6 tile draws + 1 winner), one hash per line. Published as soon as they are computed.

Advanced settingsNetwork, descriptor, Esplora endpoint, and proof constantsExpandCollapse

Commitment Taproot descriptorPublic descriptor behind every round's commitment address: address N derives at descriptor / N.Esplora API URLAny Esplora-compatible endpoint works; point this at your own node to remove the last third party.Draw delay blocksBlocks between commitment confirmation and the draw block, so the randomness source cannot exist when entrants are sealed. LUCKOTTO-1 pins 2 blocks.Hashes per checkpointThe sequential anti-grinding work floor. LUCKOTTO-1 pins 1,000,000,000; lower it only to rehearse the flow — the results will not match published checkpoints.

Bitcoin network

main

Block explorer

https://mempool.space

Checkpoints per round

7 (6 tile draws + 1 winner)

Checks

Every check compares two independently sourced values. Expand a row to see both sides and how the comparison is computed.

0 of 8 passing

Commitment

CSV matches the commitment published at lockWaits for the round to lock and seal its CSV commitment.Waiting

CSV HMAC computed in this browserPending

Published commitment (roundCsvHmac)Pending

HMAC-SHA256 over the exact CSV bytes, keyed by the round secret hash. Published together with the CSV when the round seals — before any draw randomness exists.

CSV matches the on-chain OP_RETURN commitmentWaits for the commitment transaction to confirm; the OP_RETURN payload is read from Esplora.Waiting

CSV HMAC computed in this browserPending

OP_RETURN payload from EsploraPending

The same HMAC is written into an OP_RETURN output of the commitment transaction. Once that transaction confirms, the commitment is anchored by Bitcoin rather than by Luckotto.

First confirmed spend equals the recorded commitment txWaits for a confirmed spend of the commitment address; the transaction broadcasts around lock.Waiting

First confirmed spend on EsploraPending

Recorded commitment txidPending

The first confirmed spend from the round's commitment address is located independently on Esplora and must be the transaction the round record names.

Round secret matches the published secret hashWaits for the round to resolve and reveal its secret; the hash itself publishes at lock.Waiting

SHA-256 of the round secretPending

Secret hash in evidencePending

SHA-256 of the revealed round secret must equal the hash published at lock — proving the secret (and everything keyed by it) existed before the draw block.

Draw

Draw height equals commitment height + draw delayWaits for the confirmed commitment transaction; its block height plus the draw delay pins the draw block.Waiting

Commitment height + delayPending

Draw height in evidencePending

The draw block must sit a fixed delay after the commitment confirmation, so the randomness source cannot exist while entrants can still change.

Draw block hash matches the recorded draw blockWaits for the round to record its draw block, a fixed delay after the commitment confirms.Waiting

Draw block hash in evidencePending

Recorded draw block hashPending

The draw block hash in evidence (fetched from Esplora at the draw height) must be the block the round record claims fed the draw.

Checkpoints match the published checkpointsWaits for the round to publish its checkpoint chain; rounds publish checkpoints as soon as they are computed after the draw block.Waiting

Each checkpoint advances the previous one by the pinned number of strictly sequential SHA-256 hashes, starting from the draw block hash.

Replayed winner equals the recorded winnerWaits for the replay: it needs the revealed round secret, the committed CSV, and the checkpoint chain.Waiting

Replayed winnerPending

Recorded winnerPending

The draw replays in this browser from the round secret, the committed CSV, and the checkpoint chain; the result must equal what the round records.

Replay

The draw outcome below is recomputed in this browser from the evidence above. The published checkpoints make that instant; to prove the chain itself instead of trusting it, regenerate it — the hashes are sequential by design, so it is deliberately slow.

Waiting for valid inputsThe replay needs the revealed round secret, the committed CSV, and the checkpoint chain from the evidence section.

Prove the checkpoint chainReady

Recomputes every checkpoint from the draw block hash with strictly sequential SHA-256 — the same anti-grinding work the server did. Expect hours in a browser tab (it keeps working in the background); the native tool below is much faster.

Needs a valid draw block hash in the evidence section first.

Verify nativelyThe Go reference implementation runs every check in minutes and trusts nothing from this page.

go install github.com/luckotto/calc/cmd/luckotto-verify@latest
luckotto-verify --app-url https://luckotto.com --esplora-url https://mempool.space/api 2